Next.js CVE-2026-94482

Exploitation requires the target to be a Next.js application built on the App Router with at least one Server Action defined - this is the exact feature precondition stated by the vendor (reflected as AT:P in the CVSS 4.0 vector). Applications using the Pages Router, and App Router applications that do not use any Server Actions, are explicitly NOT vulnerable, which meaningfully limits the exposed population. Beyond that precondition, no authentication, privileges, or user interaction are required (PR:N/UI:N), and the request is sent over the network (AV:N). The only complete fix is upgrading to 15.5.28 or 16.4.1; the vendor states no workaround exists.

This is a denial-of-service vulnerability (CWE-770, uncontrolled resource allocation) in the Next.js framework, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated issue of low attack complexity but with an attack requirement present (AT:P) - the 'requirement' aligns with the deployment precondition that the target must be an App Router application with at least one Server Action. Impact is availability-only (VA:H; VC:N/VI:N) - a single process can be driven to excessive CPU consumption, blocking further request processing. The vuln.today decision label is 'this_week', consistent with a high-severity availability flaw in widely deployed software that is not under active exploitation. No EPSS score was supplied, so quantitative exploitation probability cannot be stated. The issue is NOT on CISA KEV and no exploit/PoC reference is present in the input (the only references are the GHSA advisory and two release tags), so there is no public exploit identified at time of analysis. Net assessment: a genuine high-priority DoS for exposed Next.js App Router deployments using Server Actions, but it is a service-disruption issue with no confidentiality or integrity impact and no evidence of exploitation - upgrade on a prompt (this-week) cadence rather than as an active-incident emergency.

An attacker sends specially crafted HTTP requests over the network, without authentication, to a public Next.js App Router application that has at least one Server Action defined. The requests trigger excessive CPU usage in the handling process, blocking it from servicing other legitimate requests and degrading or taking the site offline. No public exploit code is identified at time of analysis, and the specific mechanism that causes the CPU spike is not described in the available sources.